Repository navigation
fix: API requests utilize single auth mechanism - #166
Merged
Merged
Conversation
GutenbergKit is intended to authentication REST API requests via authentication tokens. If WordPress authentication cookies are present in the request, it will take precedent over the authentication token present in the request. This can result in request authentication failures.
Simplify test set up by defaulting to the most common environment for this project.
Avoid out-of-date warnings logged in `npm` commands.
dcalhoun
marked this pull request as ready for review
August 18, 2025 13:09
dcalhoun
commented
Aug 18, 2025
| } | ||
| if ( authHeader ) { | ||
| options.headers.Authorization = authHeader; | ||
| options.credentials = 'omit'; // Avoid cookies disrupting token authentication |
Member
Author
There was a problem hiding this comment.
This is the primary change to address the bug.
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR fixes authentication conflicts in API requests by ensuring token-based authentication uses a single mechanism instead of competing with cookies. When an auth header is present, credentials are set to 'omit' to prevent browser cookies from interfering with token authentication.
- Refactored API fetch middleware to dynamically handle token authentication and omit credentials
- Added comprehensive test coverage for the new credentials handling behavior
- Updated Vitest configuration to default to jsdom environment for better test consistency
Reviewed Changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
src/utils/api-fetch.js |
Refactored authentication middleware to dynamically set credentials to 'omit' when using token auth |
src/utils/api-fetch.test.js |
Added comprehensive test suite covering various credential handling scenarios |
vitest.config.js |
Set default test environment to jsdom for consistency across the project |
src/components/editor/test/use-media-upload.test.jsx |
Removed redundant jsdom environment directive |
src/components/editor-load-notice.test.jsx |
Removed redundant jsdom environment directive |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
crazytonyli
approved these changes
Aug 18, 2025
jkmassel
added a commit
that referenced
this pull request
Aug 12, 2026
…ories Resolves 29 Dependabot advisories in the dev dependency tree. None of these packages ship in the iOS/Android app bundle -- they are build, lint, and local-WP (`@wordpress/env`) tooling. In-range bumps: - `vite` 8.0.5 -> 8.2.1 (direct devDep; floor raised to `^8.0.16`) #134 #135 - `shell-quote` -> 1.10.0 (critical #133) #165 - `fast-uri` -> 3.1.5 #163 #164 #179 #206 #207 - `js-yaml` -> 3.15.1 / 4.3.1 #157 #158 #167 #168 #200 #201 - `brace-expansion` #160 #166, `immutable` #161 #162, `tmp` #131, `fast-xml-builder` #122 #123, `simple-git` #119, `@babel/plugin-transform-modules-systemjs` #126 Scoped `overrides` (parents exact-pinned the vulnerable version): - `ws` -> 8.21.0, keeping 7.5.13 for `react-devtools-core` #138 #153 - `qs` -> 6.15.2 under `@wordpress/env` #130 - `minimatch` -> 9.0.9 under `@typescript-eslint/typescript-estree` #65 - `@babel/core` -> 7.29.7 under `@wordpress/babel-preset-default` #154 Not addressed here: `electron` (33 alerts) and its bundled `got` (#33) are pinned by `react-devtools@7.0.1` -- already the latest, and npm's only "fix" is a breaking downgrade to `react-devtools@1.0.5`. Runtime-scope advisories (`seroval`, `nanoid`, `postcss`, `showdown`, `uuid`) are out of scope for a dev-only bump. Verified: `npm run test:unit` (202 passing) and `npm run build` green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Omit credentials (cookies) for
apiFetchcalls.Why?
Fix CMM-684.
GutenbergKit is setup to utilize token authentication. The presence of
authentication cookies means there were duplicative authentication mechanisms,
which can cause failed requests for some endpoints that favor cookies.
How?
credentials: 'omit'for allapiFetchcalls.tests.
jsdomenvironment—the mostcommon for this project.
caniusedatabase to avoid out-of-date logs innpmcommands.Testing Instructions
See wordpress-mobile/WordPress-iOS#24747.
Accessibility Testing Instructions
N/A, no user-facing changes.
Screenshots or screencast
N/A, no user-facing changes.